JavaScript Sandbox Escape via Type Confusion in isolated-vm

<h2> 1. Overview </h2> <ul> <li> <strong>Report Title:</strong> ARMORY CASTLE Exploits BeyondTrust</li> <li> <strong>Source:</strong> Google Threat Intelligence Group</li> <li>

A critical vulnerability in the popular Node.js sandboxing library vm2 allows escaping the sandbox and executing arbitrary code on the host system. [...]

<ul> <li>[Why JavaScript JITs Are High-Value Targets]</li> <li>[Common JIT Vulnerability Classes and How Exploits Chain]</li> <li>[Applying CFI, PAC, and Memory Tagging Without